session cleanup on every request

[laylatichy]

Tempest version

3.6

PHP version

8.5

Operating system

macOS

Description

Im doing some optimizations on my app for queries as I added debug bar and noticed that session cleanup runs on every request

https://github.com/tempestphp/tempest-framework/blob/3.x/packages/http/src/Session/ManageSessionMiddleware.php

$this->sessionManager->deleteExpiredSessions()

there is already command that cleans this up every minute

packages/http/src/Session/CleanupSessionsCommand.php

@innocenzi was there a specific reason for this? Im fine submitting pr but maybe I'm missing osmething

[innocenzi]

It was an oversight from me to not remove the schedule-based clean up. I'm not sure what's the ideal approach there, but in my mind, the less infra needed, the better—hence why I would prefer not to have schedule-based cleaning as the default.

Is this a performance issue on your app? Which driver are you using?

cc @tempestphp/core-contributors, it's an interesting topic

[laylatichy]

@innocenzi yeah performance wise, Mysql, I didint switch to redis yet but the hit will be there as well

my staging env right now has 60k ish sessions so its okish still but once i reach 500k or 1mil + that will be a lot of unnecessary work doing on each request

if I swicth to redis I'll probably comeback with the same as redis sessions dont need a cleanup because ttl can be set, maybe redis session does that already, didint look, mysql sessions with anything above 1 mil sessions and a lot of requests will probably slow down a lot

[innocenzi]

Looking back at the database manager, the first thing to do would be to optimize it. I made it in a loop for events to fire but that's very stupid, there are two better options:

• one query to fetch all session IDs that need to be deleted, and another to delete them in bulk, then trigger an event for all sessions deleted
• same thing but trigger a single event with a list of session IDs (breaking change)

That aside, we could make the cleaning behavior configurable. I think that cleaning up on every request is fine, but that should be overrideable more easily if needed